Fix oneOf with no top-level type

p1c2u · p1c2u · commit 7bc3f4594c2b · 2026-05-16T08:05:13.000+01:00
diff --git a/openapi_core/unmarshalling/schemas/unmarshallers.py b/openapi_core/unmarshalling/schemas/unmarshallers.py
@@ -46,7 +46,18 @@ def unmarshal_state(self, state: ValidationState) -> Optional[List[Any]]:
                 self.items_unmarshaller.unmarshal_state(item_state)
                 for item_state in state.item_states
             ]
-        return self(value=state.value)
+        # No per-item states means the item schema didn't need state
+        # (predicate said so). The outer validate() has already covered
+        # each item, so go through unmarshal_state with a bare state
+        # rather than unmarshal (which would re-validate).
+        items_unmarshaller = self.items_unmarshaller
+        items_schema = items_unmarshaller.schema
+        return [
+            items_unmarshaller.unmarshal_state(
+                ValidationState(schema=items_schema, value=item)
+            )
+            for item in state.value
+        ]
 
     @property
     def items_unmarshaller(self) -> "SchemaUnmarshaller":
@@ -196,10 +207,20 @@ def _unmarshal_properties_from_state(
             except KeyError:
                 if "default" not in prop_schema:
                     continue
+                # Default values were not part of the validated input,
+                # so they must go through full unmarshal (revalidates).
                 prop_value = (prop_schema / "default").read_value()
+                properties[prop_name] = self.schema_unmarshaller.evolve(
+                    prop_schema
+                ).unmarshal(prop_value)
+                continue
+            # Present-but-state-skipped: validate() already covered it,
+            # so a bare-state unmarshal_state avoids re-validation.
             properties[prop_name] = self.schema_unmarshaller.evolve(
                 prop_schema
-            ).unmarshal(prop_value)
+            ).unmarshal_state(
+                ValidationState(schema=prop_schema, value=prop_value)
+            )
 
         if schema_only:
             return properties
@@ -226,8 +247,13 @@ def _unmarshal_properties_from_state(
                         )
                     )
                     continue
-                properties[prop_name] = additional_prop_unmarshaler.unmarshal(
-                    prop_value
+                # State skipped for trivial child; validate() covered it.
+                properties[prop_name] = (
+                    additional_prop_unmarshaler.unmarshal_state(
+                        ValidationState(
+                            schema=additional_prop_schema, value=prop_value
+                        )
+                    )
                 )
 
         return properties
@@ -246,8 +272,34 @@ def __call__(self, value: Any) -> Any:
 
     def unmarshal_state(self, state: ValidationState) -> Any:
         primitive_type = state.primitive_type
+        # Bare-state fast paths (used for sub-trees that didn't need
+        # full state-building) carry primitive_type=None. Fall back to
+        # computing it from the value -- it's the same work
+        # MultiTypeUnmarshaller.__call__ does, only when actually
+        # needed, and only for sub-trees too trivial to cache.
         if primitive_type is None:
-            return None
+            primitive_type = self.schema_validator.get_primitive_type(
+                state.value
+            )
+            if primitive_type is None:
+                return None
+        # If the matched validation result lives in a composed branch
+        # (oneOf / first anyOf), the type unmarshaller must be bound
+        # to THAT branch's schema -- not to ours -- so nested keywords
+        # like `items` / `properties` resolve against the matched
+        # branch. Without this, an outer "pure-oneOf" schema would
+        # dispatch to an ArrayUnmarshaller bound to a schema with no
+        # `items` keyword. Walk the chain to its leaf.
+        target_state = state
+        while target_state.one_of_state is not None:
+            target_state = target_state.one_of_state
+        if target_state is state and state.any_of_states:
+            target_state = state.any_of_states[0]
+        if target_state is not state:
+            target_unmarshaller = self.schema_unmarshaller.evolve(
+                target_state.schema
+            )
+            return target_unmarshaller.unmarshal_state(target_state)
         unmarshaller = self.schema_unmarshaller.get_type_unmarshaller(
             primitive_type
         )
diff --git a/openapi_core/validation/schemas/datatypes.py b/openapi_core/validation/schemas/datatypes.py
@@ -1,10 +1,10 @@
 from dataclasses import dataclass
-from dataclasses import field
+from types import MappingProxyType
 from typing import Any
 from typing import Callable
 from typing import Dict
+from typing import Mapping
 from typing import Optional
-from typing import Tuple
 
 from jsonschema_path import SchemaPath
 
@@ -13,19 +13,45 @@
 FormatValidatorsDict = Dict[str, FormatValidator]
 
 
-@dataclass(frozen=True)
+# Shared, read-only "empty container" singletons used as the default
+# values for ValidationState collection fields. Because ValidationState
+# is frozen these are safe to share across instances -- there is no
+# code path that mutates the fields after construction. Using a single
+# empty mapping/tuple instead of allocating a fresh dict/() for every
+# leaf state cuts the per-instance allocation count from ~5 to 1.
+_EMPTY_STATES: Mapping[str, "ValidationState"] = MappingProxyType({})
+_EMPTY_STATE_TUPLE: tuple["ValidationState", ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
 class ValidationState:
+    """The result of validating ``value`` against ``schema``.
+
+    Carries forward two pieces of information that the unmarshaller
+    would otherwise have to recompute:
+
+    1. The fact that ``value`` was validated -- so child unmarshallers
+       can skip re-running ``validate()`` against the same value.
+    2. Which composed schemas matched (``one_of_state``,
+       ``any_of_states``, ``all_of_states``) -- so the unmarshaller
+       doesn't have to re-resolve ``oneOf`` / ``anyOf`` / ``allOf``
+       branch selection at unmarshal time.
+
+    State is only built for sub-trees that actually carry one of these
+    two pieces of information. Sub-trees with no composition anywhere
+    don't get a populated state; the unmarshaller takes a fast bare-
+    state path for them. See ``SchemaValidator._schema_needs_state``.
+    """
+
     schema: SchemaPath
     value: Any
     primitive_type: Optional[str] = None
-    property_states: Dict[str, "ValidationState"] = field(default_factory=dict)
-    additional_property_states: Dict[str, "ValidationState"] = field(
-        default_factory=dict
-    )
-    item_states: Tuple["ValidationState", ...] = ()
+    property_states: Mapping[str, "ValidationState"] = _EMPTY_STATES
+    additional_property_states: Mapping[str, "ValidationState"] = _EMPTY_STATES
+    item_states: tuple["ValidationState", ...] = _EMPTY_STATE_TUPLE
     one_of_state: Optional["ValidationState"] = None
-    any_of_states: Tuple["ValidationState", ...] = ()
-    all_of_states: Tuple["ValidationState", ...] = ()
+    any_of_states: tuple["ValidationState", ...] = _EMPTY_STATE_TUPLE
+    all_of_states: tuple["ValidationState", ...] = _EMPTY_STATE_TUPLE
 
 
 __all__ = ["FormatValidator", "FormatValidatorsDict", "ValidationState"]
diff --git a/openapi_core/validation/schemas/validators.py b/openapi_core/validation/schemas/validators.py
@@ -4,12 +4,19 @@
 from typing import TYPE_CHECKING
 from typing import Any
 from typing import Iterator
+from typing import Mapping
 from typing import Optional
 
 from jsonschema.exceptions import FormatError
 from jsonschema.protocols import Validator
 from jsonschema_path import SchemaPath
 
+from openapi_core.validation.schemas.datatypes import (
+    _EMPTY_STATE_TUPLE as _EMPTY_STATES_TUPLE,
+)
+from openapi_core.validation.schemas.datatypes import (
+    _EMPTY_STATES as _EMPTY_STATES_MAP,
+)
 from openapi_core.validation.schemas.datatypes import FormatValidator
 from openapi_core.validation.schemas.datatypes import ValidationState
 from openapi_core.validation.schemas.exceptions import InvalidSchemaValue
@@ -40,19 +47,91 @@ def validate(self, value: Any) -> None:
             schema_type = (self.schema / "type").read_str_or_list("any")
             raise InvalidSchemaValue(value, schema_type, schema_errors=errors)
 
+    # Cache the recursive "does this schema benefit from a ValidationState?"
+    # check, keyed on the SchemaPath. SchemaPath is hashed by content, so
+    # two SchemaPaths pointing at the same spec location share a cache
+    # slot regardless of identity -- safe across GC, bounded by the number
+    # of distinct schema shapes in the spec rather than by input volume.
+    _needs_state_cache: dict[SchemaPath, bool] = {}
+
+    @classmethod
+    def _schema_needs_state(cls, schema: SchemaPath) -> bool:
+        """True iff building a ValidationState for ``schema`` carries
+        information the unmarshaller can reuse: either composition
+        (oneOf/anyOf/allOf) on this node, or a descendant that does.
+
+        Cycle-safe: a False sentinel is stored before recursing, so a
+        $ref loop terminates and the real answer overwrites the
+        sentinel once the recursion completes.
+        """
+        cache = cls._needs_state_cache
+        cached = cache.get(schema)
+        if cached is not None:
+            return cached
+        # Self-composition is the strongest signal; check it first to
+        # short-circuit the cheap case.
+        if "oneOf" in schema or "anyOf" in schema or "allOf" in schema:
+            cache[schema] = True
+            return True
+        # Seed the in-progress sentinel for cycle protection.
+        cache[schema] = False
+        # Recurse into children. We only need to find one descendant
+        # that needs state to flip our own answer.
+        result = False
+        if "properties" in schema:
+            try:
+                prop_iter = (schema / "properties").items()
+            except Exception:
+                prop_iter = ()
+            for prop_name, prop_schema in prop_iter:
+                if not isinstance(prop_name, str):
+                    continue
+                if cls._schema_needs_state(prop_schema):
+                    result = True
+                    break
+        if not result and "additionalProperties" in schema:
+            try:
+                ap = schema / "additionalProperties"
+            except Exception:
+                ap = None
+            if ap is not None and cls._schema_needs_state(ap):
+                result = True
+        if not result and "items" in schema:
+            try:
+                items = schema / "items"
+            except Exception:
+                items = None
+            if items is not None and cls._schema_needs_state(items):
+                result = True
+        cache[schema] = result
+        return result
+
     def validate_state(self, value: Any) -> ValidationState:
         self.validate(value)
         return self._build_trusted_state(value)
 
     def _build_trusted_state(self, value: Any) -> ValidationState:
-        primitive_type = self.get_primitive_type(value)
-        property_states = {}
-        additional_property_states = {}
-        item_states: tuple[ValidationState, ...] = ()
-        one_of_state = None
-        any_of_states: tuple[ValidationState, ...] = ()
-        all_of_states: tuple[ValidationState, ...] = ()
+        """Build a ValidationState for ``value`` against ``self.schema``.
 
+        Pre-condition: ``value`` has already been validated against the
+        schema (typically by an outer ``validate_state``). This method
+        does NOT re-validate -- it only records the composition-branch
+        decisions and recurses into children that themselves need
+        state.
+        """
+        primitive_type = self.get_primitive_type(value)
+        property_states: Mapping[str, ValidationState] = _EMPTY_STATES_MAP
+        additional_property_states: Mapping[str, ValidationState] = (
+            _EMPTY_STATES_MAP
+        )
+        item_states: tuple[ValidationState, ...] = _EMPTY_STATES_TUPLE
+        one_of_state: Optional[ValidationState] = None
+        any_of_states: tuple[ValidationState, ...] = _EMPTY_STATES_TUPLE
+        all_of_states: tuple[ValidationState, ...] = _EMPTY_STATES_TUPLE
+
+        # Composition keywords: always cache the branch selection,
+        # because re-resolving it at unmarshal time is exactly the work
+        # ValidationState exists to avoid.
         if "oneOf" in self.schema:
             one_of_schema = self.get_one_of_schema(value)
             if one_of_schema is not None:
@@ -76,22 +155,41 @@ def _build_trusted_state(self, value: Any) -> ValidationState:
                     for all_of_schema in all_of_schemas
                 )
 
+        # Children: recurse only into sub-trees that themselves contain
+        # composition. Sub-trees without composition can be unmarshalled
+        # via the bare-state fast path -- no cached state needed.
         if primitive_type == "object" and isinstance(value, dict):
+            new_props: dict[str, ValidationState] = {}
             for prop_name, prop_schema in self._get_input_properties(
                 value
             ).items():
-                property_states[prop_name] = self.evolve(
+                if not self._schema_needs_state(prop_schema):
+                    continue
+                new_props[prop_name] = self.evolve(
                     prop_schema
                 )._build_trusted_state(value[prop_name])
+            if new_props:
+                property_states = new_props
+
+            new_addl: dict[str, ValidationState] = {}
             for (
                 prop_name,
                 additional_prop_schema,
             ) in self._get_input_additional_properties(value).items():
-                additional_property_states[prop_name] = self.evolve(
+                if not self._schema_needs_state(additional_prop_schema):
+                    continue
+                new_addl[prop_name] = self.evolve(
                     additional_prop_schema
                 )._build_trusted_state(value[prop_name])
+            if new_addl:
+                additional_property_states = new_addl
         elif primitive_type == "array" and isinstance(value, list):
-            item_states = tuple(self.iter_item_states(value))
+            # Skip per-item state when the item schema itself doesn't
+            # need state -- the unmarshaller's bare-state fast path
+            # handles each item.
+            built = self._build_item_states_if_needed(value)
+            if built:
+                item_states = built
 
         return ValidationState(
             self.schema,
@@ -105,6 +203,19 @@ def _build_trusted_state(self, value: Any) -> ValidationState:
             all_of_states=all_of_states,
         )
 
+    def _build_item_states_if_needed(
+        self, value: list
+    ) -> tuple[ValidationState, ...]:
+        if "items" not in self.schema:
+            return _EMPTY_STATES_TUPLE
+        items_schema = self.schema / "items"
+        if not self._schema_needs_state(items_schema):
+            return _EMPTY_STATES_TUPLE
+        item_validator = self.evolve(items_schema)
+        return tuple(
+            item_validator._build_trusted_state(item) for item in value
+        )
+
     def evolve(self, schema: SchemaPath) -> "SchemaValidator":
         cls = self.__class__
 
